5b9304dd6cf57dd08b16fc5d30248eaff973d67d2b593f065ea84e69d8bae3e9

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe
Size

300KB
MD5

2c7b091ef78ff0eeb452486ec8f6e570
SHA1

03ea278d6990650f83821f17c459a453a5c18fb8
SHA256

5b9304dd6cf57dd08b16fc5d30248eaff973d67d2b593f065ea84e69d8bae3e9
SHA512

b15dfcab2d95b8bd8dc5696cff3cef524c80e3ff4b00af051737c695f24c40dc7ce4dd12584a263c94610d6c5f569e474a20f8f597fab27d172af3c9e14f337f
SSDEEP

6144:NaYAHzYPwo3d2RGL2cBo7RP03rM2IQ8o4de9ip4:NtCQwo3UC2cBIRujj4dIi

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe\Debugger = "C:\\Windows\\system32\\ctfmonxjl.exe"	regsvr32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2480455240-981575606-1030659066-1000\Control Panel\International\Geo\Nation	2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe

Loads dropped DLL 1 IoCs

pid	Process
4768	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{265010C3-498D-3CAC-80B8-E06842CB902D}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{265010C3-498D-3CAC-80B8-E06842CB902D}\IExplore = "1"	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mt51177.dll	2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ctfmonxjl.exe	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ = "IDOMPeek"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D\CLSID\ = "{265010C3-498D-3CAC-80B8-E06842CB902D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\ = "D"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\ = "D"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D\ = "D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\ProgID\ = "D.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\InprocServer32\ = "C:\\Windows\\SysWow64\\mt51177.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\ = "LIB"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mt51177.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\D.1\CLSID\ = "{265010C3-498D-3CAC-80B8-E06842CB902D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib\ = "{2B942D2E-8361-3882-AF85-ED48F2830FD6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{265010C3-498D-3CAC-80B8-E06842CB902D}\VersionIndependentProgID\ = "D"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2B942D2E-8361-3882-AF85-ED48F2830FD6}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\ = "IDOMPeek"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD67DEA3-0664-3FC9-9356-9BBF32F6AD6D}\TypeLib\ = "{2B942D2E-8361-3882-AF85-ED48F2830FD6}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4768	3080	2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe	85
PID 3080 wrote to memory of 4768	3080	2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe	85
PID 3080 wrote to memory of 4768	3080	2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2c7b091ef78ff0eeb452486ec8f6e570_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\mt51177.dll
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Modifies registry class
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mt51177.dll

Filesize
240KB

MD5
4428e9f2f02048653eadcfde16b1017b

SHA1
fef1b12f41b006d1511a32b1f789aeacd1002d14

SHA256
2b601272be84f4c41dc4c1fc733803d0bbdaff4c359a706c2e56ad751cdbd734

SHA512
add58efa3fbf7e41e6a786e7a30f8fb851bdb54558faeb0cd624ccefe27165c62155a5d2bb09bd24dd19c18d98271c9398aeaa6892bc9d61adfda2a602601f71

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads